In HTTP_CTRL_CHARS_HOST and PORN_4, there is no "?" after "https", so it never matches "http://";. I'm curious as to how many spamm messages include an https URI; I've never seen any.
Index: 20_uri_tests.cf =================================================================== RCS file: /cvsroot/spamassassin/spamassassin/rules/20_uri_tests.cf,v retrieving revision 1.1 diff -u -3 -p -r1.1 20_uri_tests.cf --- 20_uri_tests.cf 5 Mar 2002 17:44:51 -0000 1.1 +++ 20_uri_tests.cf 8 Mar 2002 03:44:49 -0000 @@ -19,10 +19,10 @@ uri HTTP_ESCAPED_HOST /^https?\:\/ describe HTTP_ESCAPED_HOST Uses %-escapes inside a URL's hostname # note: do not match \r or \n -uri HTTP_CTRL_CHARS_HOST /^https\:\/\/[^\/]*[\x00-\x08\x0b\x0c\x0e-\x1f]/ +uri HTTP_CTRL_CHARS_HOST /^https?\:\/\/[^\/]*[\x00-\x08\x0b\x0c\x0e-\x1f]/ describe HTTP_CTRL_CHARS_HOST Uses control sequences inside a URL's hostname -uri PORN_4 /^https:\/\/[\w\.]*(?:xxx|sex|anal|slut|pussy|cum|nympho|suck|porn|hardcore|taboo|whore|voyeur|lesbian|gurlpages|naughty|lolita|teen|schoolgirl|kooloffer|erotic)\w*\./ +uri PORN_4 /^https?:\/\/[\w\.]*(?:xxx|sex|anal|slut|pussy|cum|nympho|suck|porn|hardcore|taboo|whore|voyeur|lesbian|gurlpages|naughty|lolita|teen|schoolgirl|kooloffer|erotic)\w*\./ describe PORN_4 Uses words and phrases which indicate porn (4) # some frequently-advertised URLs -- Visit http://dmoz.org, the world's | Give a man a match, and he'll be warm largest human edited web directory. | for a minute, but set him on fire, and | he'll be warm for the rest of his life. [EMAIL PROTECTED] ICQ: 132152059 | _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
